GitHub Advisoryadvisory · NuGet

GHSA-xh5m-8qqp-c5x7 Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel

HIGH Published 2023-10-10 Modified 2024-06-03 Official page ↗
Aliases
CVE-2023-38171
Ecosystem
NuGet
Packages
Microsoft.Native.Quic.MsQuic.Schannel, Microsoft.Native.Quic.MsQuic.OpenSSL
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-476
Reviewed
2023-10-10

Affected packages

• NuGet Microsoft.Native.Quic.MsQuic.Schannel: < 2.2.3 → fixed in 2.2.3 • NuGet Microsoft.Native.Quic.MsQuic.OpenSSL: < 2.2.3 → fixed in 2.2.3

Description

Impact The MsQuic server application or process will crash, resulting in a denial of service. Patches The following patch was made: • Don't Allow Version Negotiation Packets for Server Connections - https://github.com/microsoft/msquic/commit/3226cff07d22662f16fc98d605656860e64cd343 Workarounds Beyond upgrading to the patched versions, there is no other workaround. You must upgrade or disable MsQuic functionality.

Related

Alias · CVE (1)

  • CVE-2023-38171 Microsoft QUIC Denial of Service Vulnerability vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-476 NULL Pointer Dereference weakness

References